fix(bin): handle dash-leading harness process names

[sparkus]

Intent

Fix the macOS guard-path noise caused by BSD basename treating dash-leading process command names from ps as options. On current main at 99533c5, make every equivalent ps-derived basename operand in bin/fm-harness.sh and the shared session-lock ancestry/liveness helpers use an explicit option terminator so a login-shell command name such as literal -zsh is treated as data, preserving existing harness detection semantics. Survey bin/ for comparable basename, dirname, or similar calls that can receive dash-leading values from ps, Git, or user paths; fix direct equivalents and report broader unrelated CLI-path cases rather than expanding this patch. Add a regression test that fails on the unfixed macOS code with literal -zsh-style input, keep the diff proportionate, target the pull request at main on the origin repository, use attribution-neutral wording in the PR, and do not merge.

What Changed

• Treat ps-derived command names as literal basename operands in harness detection and shared session-lock ancestry/liveness, preventing BSD basename option noise for dash-leading names while preserving existing matching behavior.
• Add hermetic regression coverage for -zsh ancestry and -codex liveness, clearing ambient harness markers so the test exercises process traversal.

Risk Assessment

✅ Low: The fix is narrowly scoped, covers all three direct ps-derived basename operands, preserves existing detection semantics, and the regression now hermetically exercises literal dash-leading process names.

Testing

The supplied diff and focused test file passed, and a macOS CLI transcript directly demonstrates the original BSD basename failure and corrected -- behavior. This is a CLI-only change, so no screenshot or rendered UI artifact applies.

Evidence: macOS dash-leading basename CLI transcript

macOS BSD basename -zsh exits 1 with “illegal option -- z”; basename -- -zsh exits 0 and outputs -zsh. The end-to-end regression reports: “ok - harness identity: dash-leading ps command names are basename operands, not options”.

macOS BSD basename dash-leading operand demonstration
$ /usr/bin/basename -zsh
exit=1 output=/usr/bin/basename: illegal option -- z
usage: basename string [suffix]
       basename [-a] [-s suffix] string [...]
$ /usr/bin/basename -- -zsh
exit=0 output=-zsh
target end-to-end regression result:
ok - harness identity: dash-leading ps command names are basename operands, not options

Evidence: Focused harness and session-lock test log

ok - A1 fm-harness.sh secondmate resolves the fallback chain; crew mode unchanged
ok - C1 fm-harness.sh secondmate-model/secondmate-effort resolve the optional tokens; bare harness stays empty (backward-compat)
ok - pi-signed identity: authoritative launch selection distinguishes shared wrapper ancestry
ok - harness identity: dash-leading ps command names are basename operands, not options
ok - B1 propagate_inheritable_config: copy, idempotence, convergence, absence-mirror, exclusion, no-op, skip diagnostics
ok - B2 spawn: secondmate runs the secondmate harness; its home inherits declared config
ok - B3 spawn: an absent secondmate-harness falls back to the crew harness (backward-compat)
ok - B4 spawn: no config at all -> own harness and no propagation side effects
ok - B5 spawn: an explicit per-spawn harness arg overrides config/secondmate-harness
ok - B6 spawn: an unverified resolved secondmate harness is refused (guard intact)
ok - B5b spawn: FM_BACKEND wins over inherited config/backend
ok - B5c spawn: explicit --backend wins over FM_BACKEND and inherited config/backend
ok - C2 spawn: a bare harness-only secondmate-harness file launches with no model/effort flag (backward-compat)
ok - C3 spawn: config/secondmate-harness's model token threads --model into the launch and meta
ok - C4 spawn: config/secondmate-harness's model+effort tokens thread into the launch and meta
ok - C5 spawn: an explicit --model overrides config/secondmate-harness's model token; the file's effort token still applies
ok - C6 spawn: an explicit --effort overrides config/secondmate-harness's effort token; the file's model token still applies
ok - C7 spawn: an explicit --harness starts with clean model/effort defaults
ok - C8 spawn: an explicit --harness still honors explicit model/effort flags
ok - C9 spawn: the harness fallback chain still resolves with no tokens; crew/scout launches are unaffected by this feature
ok - B7 bootstrap sweep pushes, re-converges, and mirrors absence; never inherits secondmate-harness
ok - B8 bootstrap sweep propagates config even when the home's tracked files are already current
ok - B9 bootstrap sweep defers new inherited config until the home ignores it
ok - B10 bootstrap sweep with no inherited config is a config no-op and still fast-forwards
ok - B12b backend inheritance: present values and primary absence converge exactly
ok - B11 bootstrap sweep surfaces config propagation failures
ok - B11 bootstrap rereads completed config writes after partial propagation
ok - B12 config-push propagates via shared live discovery, reports items, rereads on change only, and does not fast-forward
ok - B13 config-push reports dirty, non-allowing, and invalid homes without failing warnings-only runs
ok - B14 config-push exits nonzero on real propagation errors
ok - B14 config-push rereads completed config writes after partial propagation
ok - B15 config reread is per-home, exact-byte, ordered, and pointer-only
ok - B16 config reread isolation, ABSENT, generation safety, send failure, and retry
ok - B20 config reread publication failures retain exact generations for retry
ok - B21 config reread instruction-write failures retain exact retry generations
ok - B21 config reread preserves exact bytes when temporary adoption also fails
ok - B21 config reread serializes concurrent propagation and delivery
ok - B22 full config reread retry queues drain before new publication
ok - B23 mixed config reread delivery failures still bound sent history
ok - B26 config reread delivery stops after the oldest failed generation
ok - B17 config reread skips unchanged homes and reads destination post-write bytes
ok - B18 bootstrap config reread path works; spawn flexibility remains defaults-only
ok - B19 bootstrap respawns before inherited-config reread
ok - B25 spawn quarantines stale rereads without blocking relaunch
ok - B24 bootstrap detect-only mode remains filesystem read-only
# all fm-secondmate-harness tests passed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• ⚠️ tests/fm-secondmate-harness.test.sh:221 - This regression is not isolated from supported harness markers. If the suite is launched with CLAUDECODE=1, PI_CODING_AGENT=true, or GROK_AGENT=1, fm-harness.sh returns from environment detection before consulting the fake ps, so the expected codex assertion can fail without exercising the fix. Clear all three markers for this invocation, as other harness-sensitive tests do.

🔧 Fix: Make dash-leading harness regression hermetic
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• Inspected git diff 99533c5d7d3702050e6084429dddff6ea4fe1aa0..4a690389c077104828d240cad9ec5a7794fdffc3 -- bin/fm-harness.sh bin/fm-session-lock-lib.sh tests/fm-secondmate-harness.test.sh.
• Ran git diff --check 99533c5d7d3702050e6084429dddff6ea4fe1aa0..4a690389c077104828d240cad9ec5a7794fdffc3.
• Ran ./tests/fm-secondmate-harness.test.sh; the focused regression exercised literal -zsh harness traversal, session-lock ancestry, literal -codex liveness, and absence of stderr option noise.
• Ran /usr/bin/basename -zsh and /usr/bin/basename -- -zsh on macOS to capture the unfixed BSD failure and corrected operand behavior.
• Surveyed bin/ with rg for ps-derived command names and related basename/dirname calls; all three direct ps-derived basename operands use --, while broader user-path cases remain outside this patch.
• Verified final git status --short --branch, exact HEAD, evidence files, and cleanup state.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.